TeamViewer Tensor - Detailed Review
TeamViewer Tensor - Detailed Review
How to Establish
an Enterprise
Grade Security
Posture for
Remote
Connectivity
Section title
Table of Content
The Processes 21
Additional Resources 27
Establishing Enterprise-wide
Security Posture
Today, enterprises rely heavily on remote handful of operators and users from a
connectivity to manage a majority of single location. However, with the move
their IT operations. In addition, the rise towards digital transformation providing
of distributed workforce and adoption borderless access to employees, partners,
of work-from-home policies have led and vendors, security can no longer be
to a significant dependence on remote treated as an afterthought.
access and control capabilities. As a
consequence, the scope of security has The work environment in these connected
increased manifold. enterprises is constantly evolving. They
are a complex ecosystem comprising of
In the past, security requirements were humans, technology stacks and workflows.
discrete since IT infrastructure was Most of the ecosystem is managed
managed from close proximity within remotely through various IT systems and
company firewalls and accessed by a network equipment.
Today’s work
environment is
constantly evolving
and changing
3
A Framework for Secure Remote Connectivity
Rules
The golden rules for ensuring
a secure remote connectivity
experience
Configurations
Configuration parameters that
involve security in general
Risks
Potential risks that need to be
safeguarded against
Actors
The actors involved in or affected
by security breaches
Expectations
Setting expectations for a more
secure remote connectivity
experience
Commitments
Establishing an organization-
Security wide security posture
framework at
TeamViewer
4
Establishing a robust
security posture starts with
a firm commitment
5
Why Secure Enterprise-wide
Remote Connectivity matters
Establishing a robust security posture starts with a firm commitment. This commitment
must be driven as a top-down corporate responsibility with initiatives such as:
Did You Know • TeamViewer is an audited member of the Forum of Incident Response and
Security Teams (FIRST), a leading association for incident responders.
• TeamViewer cooperates with the leading crowd sourced security platform
YesWeHack to engage with a large community of security researchers.
• TeamViewer has been rated as Top 1% in the tech industry by BitSight
Security Rating, an independent 3rd party company for measuring
cybersecurity risk and security management effectiveness.
6
Layer 2: Setting Expectations
Access Control
Privacy
Fundamental
Security Measures
7
Layer 3: Defining the Actors
Setting security expectations is only possible by defining the actors that are involved.
For example, a privacy breach involving credit card details affects all the persons whose
data is exposed. In this case, the credit card holder is an actor. From an organizational
standpoint, these actors are directly or indirectly involved in a security-related incident,
either as a beneficiary or a victim.
Human
A user that is assigned to various broader categories such as an
employee, partner, or vendor interacting with other humans and
machines. They are further categorized into more granular groups and
roles based on departments and corporate functions.
Machine
Represents the computers, servers, networking devices, and other
hardware/software assets that are used by various stakeholders
with an organization to conduct their daily business, operational, and
service workflows.
Bot
A programmable hardware/software with minimal intelligence to
mimic a subset of behavior representing either a human user or a
machine. It serves as a proxy for humans to automate tasks.
8
70 % of organizations
cannot secure data across multiple cloud and on-premises
environments.
92 % of organizations
cannot securely enable and extend new cloud-native capabilities to
internal and external partners.
33 % increase
in the number of incidents caused by vulnerability exploitations from
2020 to 2021.
9
Asserting the Underlying Assumptions for
Security Posture
10
Built-in Security Features
Did You Know TeamViewer supports built-in and additional security features such as:
11
Security Standards and Certifications
Security standards and certifications lay the groundwork for security compliance and
expectations of any platform.
In the case of remote connectivity platforms, here are some of the critical standards and
certifications:
Encryption Standards
define a mechanism to encrypt
information. AES (Advanced Encryption
Standard) and RSA (Rivest, Samir,
Adleman) are the two popular standards
for encrypting data and information
exchanged in a remote connectivity
session.
Security Frameworks
define policies on an organizational level
involving legal, physical and technical
controls to regulate all the information
systems and access to the data generated
by them. ISO 27001 and GDPR are the
most well-known examples of security and
privacy frameworks.
Code Signing
is a method of digital attestation where a
file or a software executable is prevented
from alteration or corruption, thereby
asserting its originality and integrity.
12
Security is an ever-evolving
challenge
13
Did You Know TeamViewer is backed by:
• End-to-end 4096 bit RSA key encryption and 256 bit AES encrypted session
• GDPR, HIPAA / HITECH, TISAX, SOC 2, SOC 3, ISO 27000 compliances
• Best-in-class security posture rating by BitSight - an independent 3rd party
cybersecurity ratings company
• IAPP gold membership
• Digital Risk Protection
Vulnerability Disclosures
Being transparent about possible security vulnerabilities is the best
way to impede the pace of exploitation of a security hole. This way,
enterprises using a specific platform are well informed, whether for
remote connectivity or otherwise.
14
01
Security Thought Leadership
Companies must engage in technology thought leadership
engagements to lend their voice to the current state-of-the-art on
security. There are several channels through which it is possible.
Various media outlets, communities, and collectives interested in the
security space and allied fields are the best source of collaboration for
driving such initiatives.
Did You Know TeamViewer is an authorized CVE Numbering Authority (CNA) joining the ranks
of just nine German CNAs such as Siemens, SAP, and Bosch as well as 178 vendors
globally. TeamViewer underscores its industry-leading cybersecurity focus and
posture in addition to embracing responsible disclosure in order to make our
products and services better.
As part of that, we offer clear guidance for ethical hackers by providing a VDP
(Vulnerability Disclosure Policy) to challenge ourselves to discover bugs and security
exploits.
Learn more:
vdp.teamviewer.com/p/Send-a-report
15
Layer 4: Understanding the Security Risks in
Enterprise Applications
Based on current trends in cyber and network security, there are four types of security
risks for enterprise applications:
16
Incidental Security Risks
Incidental security risks are related to intermediaries involved in a
secured communication. For example, a firewall that filters traffic to
allow only certain types of packets to a specific application. A mis-
configured firewall allows unauthorized traffic, resulting in a security
lapse. Similarly, there are different intermediaries, such as VPN
gateways, authentication servers, and storage vaults, that are involved
in managing secured communication between actors. If any of these
intermediaries are compromised, security can be jeopardized.
Intrusive Risks
Incidental Risk
Inherent Risks
17
Layer 5: The Key Security
Configuration Objects
The goal of strengthening the security posture is to mitigate these four risks.
There are a few important security parameters to achieve that. They need to
be configured as part of the overlaying security enablement within the remote
connectivity platform.
Identity Credential
It establishes a unique signature that can This is a way to verify the connection
unambiguously pinpoint an actor. before it is established between two
actors.
In many cases of secured communication,
the actual identity is always kept under This can be used for authenticating each
the wraps, while an associated temporary other, or for codifying the information
identity is used. exchanged between them, in order to
obfuscate the message.
TeamViewer offers flexible options to
create user identities based on Active Apart from password and 2FA, TeamViewer
Directory or via TeamViewer Company also supports single sign-on (SSO) for users
profile. and unattended access to remote devices
while ensuring full protection against
intrusive security risks.
Policy
It defines a set of core principles for
vetting an access request based on certain
parameters of the request. For example,
a firewall policy relies on the IP address
and port number of a request packet to
frame policies for accepting or rejecting
the packet. Similar policies are devised
for access management to machines and
systems, based on who is accessing them,
from where, and when.
18
Connectivity
It encompasses a virtual connectivity
context that establishes a secured end-
to-end session. For example, all websites
using HTTPS use an end-to-end SSL layer
to secure all HTTP traffic between the
web server and the browser. Similarly,
a VPN connection uses an IP over IP
encapsulation to define the connectivity
context.
Deployment
It governs the deployment related
parameters that are relevant for ensuring
continued security protection for
applications.
TeamViewer is a
network agnostic,
end-to-end secure
system that offers
a more reliant
connectivity than
VPN for remote
access use cases.
19
Supercharging your
Security Posture
The overlay security configuration offers
many options to tackle the security risks.
However, it may seem a daunting task to
arrive at the ideal security setting. Security
enforcement should not compromise
user experience and cause difficulties
or friction in a business’ day-to-day
operations.
The Processes
Irrespective of the many complex
combinations of configuration versus risk
possibilities, there are a few important
rules to establish security awareness
processes.
These rules provide guidance on how to arrive at the best possible security posture
supporting any enterprise remote connectivity. It is recommended that these rules be
incorporated into any system immediately after the installation and setting up of user
accounts.
21
Multi-Factor Authentication
Multi-factor authentication (MFA) offers additional authentication
layers to counter intrusive security breaches that result from the
exposure of credentials. A single-factor authentication relies on pre-
existing credentials of a user. If these credentials are compromised,
an immediate recovery is not possible. A second factor brings in an
additional temporary credential, that is generated ad hoc. It is shared
on a separate communication channel, like email, SMS or phone that
enable the actor to perform additional steps as a safeguard.
Ease of Access
Security is a burden, especially in situations where additional processes
are necessary to access the same system repeatedly. This is a case of a
human actor interacting with a machine on an everyday basis.
Allow List
An allow list defines the policies for allowing only certain actors to
access a system. This is part of the access policies for the system. It is
recommended to have a concise allow list with specific rules for actors,
instead of wild card rules that allow everyone.
22
Strong Password
Passwords are the most widely used form of credentials for any
secured communication. Therefore, it is imperative to cultivate a
culture of choosing strong passwords within the organization.
Updates
Software updates are applicable for upgrading third-party applications
and operating systems. Out of date versions are a prime target for
hackers and pose a security weakness for organizations.
Backup
Backups are applications for creating a copy of information and saving
it to another device or cloud storage. Like updates, backups should
also be automated to ensure that the most recent version of the
information is preserved.
23
TeamViewer: A Security First, Connectivity
Platform for Remote IT Management
Compliance
24
Remote connectivity is an important That trust requires us to:
component for customers that wish to
provide their employees and various • Ensure our service meets the
stakeholders with a secure and agile requirements of the most recognized
digital ecosystem. certifications and regulations
• Help our customers meet security
Our customers trust in TeamViewer certifications and regulations from
solutions to manage and protect their industries
their employees in terms of accessing
applications and data.
SOC2
Service Organization Controls 2 (SOC2) is a reporting framework for
service organizations to report on non-financial internal controls for
the five Trusted Service Principles (TSP). These principles include
system security, availability, processing integrity, confidentiality, and
privacy.
HIPAA/HITECH
TeamViewer provides remote access, remote support, and online
collaboration capabilities with the level of security and privacy
necessary for organizations to remain HIPAA compliant.
25
All of the data centers that TeamViewer uses have achieved ISO/IEC
27001 certification, which is the international standard for information
security management systems and security controls.
The data centers have implemented state-of-the-art security controls,
which means that personal access control, video camera surveillance,
motion detectors, 24×7 monitoring, and on-site security personnel
ensure access to the data center is only granted to authorized
personnel and guarantee the best possible security for hardware and
data. There is also a thorough identification check at the single point-
of-entry to the data center.
26
Additional Resources
Security Documentation
Security handbook:
community.teamviewer.com/English/kb/articles/108686-welcome-and-introduction
Multi-Factor Authentication
Access Management
Conditional access and how administrators can control incoming and outgoing connections
community.teamviewer.com/English/kb/articles/57261-get-started-conditional-access
In addition to your password protect your accounts with a physical security key
community.teamviewer.com/English/kb/articles/109554-security-key-redirection
Auditability:
Protect your business and also keep track of support experiences happening within your company
community.teamviewer.com/English/kb/articles/54970-auditability-event-log
www.teamviewer.com/support
TeamViewer US Inc.
5741 Rio Vista Dr Clearwater, FL 33760 USA
+1 800 638 0253 (Toll-Free)
Stay Connected
www.teamviewer.com